1. Web SSO with Cloud Resources using AD Federation Services
Dean Flanders and Roger Schmidt
FMI / SystemsX
Federated Identity Management Workshop
EGI Community Forum 2013
April 11th, 2013 in Manchester
MCSE joke.

2. Overview Short introduction of SystemsX Goal Current situation
Three ADFS test cases
Tool for self-federation
Azure Active Directory
Summary

3. Mission «SystemsX.ch is determined to become a world-leading initiative in quantitative Systems Biology.»
SystemsX.ch is open to any Swiss university or research institution.

5. Some Numbers and Facts 1000 scientists 200 research groups
11 universities and research institutes
Work together inter-disciplinarily

6. Problem Description
Goal: Increase sharing of resources, inter-institutional collaboration, inter-disciplinary collaboration, international collaboration, as well as academic and industry cooperation.
Problem: Lack of FIM is seriously impairing research and is a critical problem.
Solution: Robust inter-institutional self-federation approach where all users and institutions can easily participate.

7. Is this the solution?

8. Or this?

9. Solved problem?

10. A model for Europe?

11. Typical Architecture Service Providers Identity Providers
Azure
Umbrella
SWITCHaai, InCommon
Application 1
Token
Token
Fed Service
Token
Application 2
Central Fed Service
(«Broker»)
Token
Token
Fed Service
Application 3
Additional
Attributes
Claim Rules
Engine
Trusts
SAML 2.0, WS-Security, OAuth etc.

12. Example 1: Federation with Qmarkets
Custom implementations:
Specific SAML 2.0 attributes
Query SQL DB
SimpleSAMLphp
ADFS (IdP)
Qmarkets (SP)
Claim Rules
Engine
Additional
Attribute Store
Manual configurations for SAML 2.0 endpoint!
URLs
Bindings etc.
Custom claim type:

13. Example 2: Integration with Umbrella
Shibboleth
Custom implementations:
SAML attribute queries
Virtual groups, REST API
Account linking

14. Example 3: Federation with ETH-Z over Azure ACS
ADFS (IdP)
Azure ACS
ADFS (IdP)
Claim Rules
Engine
Webapp (SP)
Windows Identity Foundation

15. Self-federation Portal (a hybrid approach)

16. Self-federation Tool

17. Azure Active Directory
Azure AD is relatively mature but only recently rolled out.
Identity as a service
Consolidate identity management across cloud apps
Connect to directory from any platform, any device
Connect with people from web identity providers and other organizations
Azure AD
ISV App
Other
MSFT
Apps
Your
Custom IT
App
Office 365

18. Contoso customer premises
Azure AD Options
No Integration
Directory Data Only
Directory and Single sign-on (SSO)
Windows Azure Active Directory
Exchange
Online
Identity Services
Authentication platform
SharePoint
Online
Trust
Contoso customer premises
Active Directory Federation Server 2.0
Admin Portal/
PowerShell
IdP
Lync
Online
IdP
Directory
Store AD
MS Online Directory Sync
Provisioning
platform
InTune

19. Summary
We feel that the self-federation concept is vital to an all inclusive federation necessary for research and potentially avoids many of these long discussions.
Technically all components are available for making FIM a commodity item.
A trusted platform such as Azure offers a valuable low cost federation backbone.
Federation should be fully under the control of the institution and attribute management under the management of the user.
Next step is to make a fully functional version with Azure AD with multiple organizations, and we are happy to collaborate with others on this.